Use InvalidCredentials and also add email auth stuff

cc @lukmdo